diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index b4b7cd51d..5f8a80a23 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -106,7 +106,6 @@
             enable = true;
             excludes = [
               # We haven't linted these files yet
-              ''^tests/functional/db-migration\.sh$''
               ''^tests/functional/dump-db\.sh$''
               ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
               ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
diff --git a/tests/functional/db-migration.sh b/tests/functional/db-migration.sh
index 6feabb90d..bdbdd21fa 100755
--- a/tests/functional/db-migration.sh
+++ b/tests/functional/db-migration.sh
@@ -19,14 +19,15 @@ PATH_WITH_NEW_NIX="$PATH"
 export PATH="${NIX_DAEMON_PACKAGE}/bin:$PATH"
 clearStore
 nix-build simple.nix --no-out-link
-nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
+nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT/sk1" "$TEST_ROOT/pk1"
 dependenciesOutPath=$(nix-build dependencies.nix --no-out-link --secret-key-files "$TEST_ROOT/sk1")
 fixedOutPath=$(IMPURE_VAR1=foo IMPURE_VAR2=bar nix-build fixed.nix -A good.0 --no-out-link)
 
 # Migrate to the new schema and ensure that everything's there
 export PATH="$PATH_WITH_NEW_NIX"
-info=$(nix path-info --json $dependenciesOutPath)
+info=$(nix path-info --json "$dependenciesOutPath")
 [[ $info =~ '"ultimate":true' ]]
+# shellcheck disable=SC2076
 [[ $info =~ 'cache1.example.org' ]]
 nix verify -r "$fixedOutPath"
-nix verify -r "$dependenciesOutPath" --sigs-needed 1 --trusted-public-keys $(cat $TEST_ROOT/pk1)
+nix verify -r "$dependenciesOutPath" --sigs-needed 1 --trusted-public-keys "$(cat "$TEST_ROOT/pk1")"